CVE-2026-51760

The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the informSyncUpgfw() function. Unauthenticated attackers can exploit this by sending a crafted MQTT message to the cs_broker component. This allows th...

CVE-2026-51760

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51760

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69379

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the csbroker component...

xorg-x11-server-Xwayland security update

24.1.9-4.3 - CVE fix for: CVE-2026-55999, CVE-2026-56000 Resolves: https://redhat.atlassian.net/browse/RHEL-191518 Resolves: https://redhat.atlassian.net/browse/RHEL-191517...

OPENSUSE-SU-2026:11659-1 ffmpeg-9-libavcodec-devel-9.0.1-3.1 on GA media

These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-3.1 package on the GA media of openSUSE Tumbleweed...

ASB-A-480976221

In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

electron42 -- multiple vulnerabilities

Electron developers report: This update fixes the following vulnerabilities: CVE-2026-15764, CVE-2026-15765, CVE-2026-15766, CVE-2026-15767, CVE-2026-15768, CVE-2026-15769, CVE-2026-15770, CVE-2026-15771, CVE-2026-15772, CVE-2026-15773, CVE-2026-15774, CVE-2026-15775, CVE-2026-15776,...

EUVD-2026-69199

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51769

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the csbroker component...

CVE-2026-83743: Authorization Bypass Through User-Controlled Key

A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Update. Executing a manipulation of the argument vendorcontact can lead to authorization bypass. The attack may be performed...

CVE-2026-51760: Improper Access Control

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51748: Improper Access Control

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the csbroker component...

nodejs:22 security update

nodejs 1:22.23.2-1 - Update to version 22.23.2 Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043 Resolves: RHEL-234381 RHEL-234831 RHEL-234896 nodejs-nodemon 3.1.14-1 - Rebase to 3.1.14 - Change %setup -q /usr/bin/cat...

nodejs:24 security update

nodejs 1:24.19.0-1 - Update to version 24.19.0 nodejs-nodemon 3.1.14-3 - Fix CVE-2026-69152 - brace-expansion 3.1.14-2 - Correction to sources for 3.1.14. 3.1.14-1 - Update to version 3.1.14 3.0.3-3 - Keep BR on just npm 3.0.3-2 - Fix BR for nodejs-npm nodejs-packaging 2021.06-6 - Properly handle...

nodejs22 security update

1:22.23.1-4.0.1 - Add c-ares as dependency orabug 39781219...

iperf3 security update

3.5-12.1 - Resolves: RHEL-236174 - Add JSON value checks for getparameters CVE-2026-71217...

PT-2026-84313

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs broker component...

OPENSUSE-SU-2026:11663-1 perl-URI-5.360.0-1.1 on GA media

These are all security issues fixed in the perl-URI-5.360.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-51748

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the csbroker component...